An unusually disciplined local security scanner: SHA-pinned engines, zero scan-time egress, no telemetry, redacted secrets, a three-state honest evidence model, and rare candor about its own limits (narrow native rules, AI-drafted compliance mappings, heuristic prompt-injection detection). Well suited to agent-driven scan-fix-rescan security loops; not a substitute for deep audits, runtime testing, or compliance certification. MIT licensed, solo-maintained by Synvoya, with independent security review actively solicited.
Strongest · Documentation 19/20 Weakest · Reliability 11/20
Static review · not runListed 2026-09-07
Read the FMRS scoring method →Runtime：Node.js 22+ · Prebuilt binary cosign on PATH for O
Prerequisites: Node.js ≥22 (Node 24 LTS recommended); cosign on PATH when Opengrep or Trivy binaries need installation (fail-closed verification; Gitleaks verifies by checksum and needs no cosign). Register once per machine with your client (e.g. Claude Code: claude mcp add- codeinspectus '{"command":"npx","args":["-y","codeinspectus"]}'; Cursor: add to mcp.; VS Code: code --add-mcp; Codex: codex mcp add or config.toml with tool_timeout_sec = 600 recommended). Then run npx codeinspectus repair-engines to install hash-verified engines and databases. Scans then perform zero network I/O. Re-verify binaries any time with npx codeinspectus verify-engines.
{"mcpServers":{"codeinspectus":{"command":"npx","args":["-y","codeinspectus"]}}}
Shown for Claude Code. Other clients may use a different file or key (VS Code uses "servers") — the configurator below converts it.
{
"servers": {
"codeinspectus": {
"command": "npx",
"args": [
"-y",
"codeinspectus"
]
}
}
}
Goes in your project's .vscode/mcp.json (VS Code uses a "servers" key).
claude mcp add codeinspectus -- npx -y codeinspectus
Run it in a terminal; replace any <…> placeholders with your own values first.
After registering the client, run npx codeinspectus repair-engines once to install engines, then confirm the six tools (codeinspectus_scan, codeinspectus_rescan, codeinspectus_compliance_report, codeinspectus_explain_finding, codeinspectus_generate_sbom, codeinspectus_list_rules) appear in the client's tool list; calling codeinspectus_list_rules should show active detectors and engine_setup state.
Once connected, you can ask your AI assistant things like:
No matching tools
Listed from the project's documentation, not tested by this site.
CodeInspectus is a local-first, privacy-preserving MCP security scanner and CLI maintained by Synvoya. Any AI coding agent (Claude Code, Cursor, Codex, Windsurf, Cline, Aider) can invoke it to scan AI-generated / "vibe-coded" code for real vulnerabilities, map findings to code-level compliance-framework coverage, and drive a scan → fix → rescan loop — fully on your machine, no account, zero network egress at scan time. It orchestrates three OSS engines — Opengrep (SAST/OWASP Top 10), Gitleaks (secrets), and Trivy (dependency CVEs, IaC, SBOM) — plus first-party AI-code-specific checks (Supabase RLS / inverted authz, prompt-injection sinks, model tool arguments reaching shell sinks, client-writable user_metadata authorization, dangerous HTML rendering, Firebase public writes, GitHub Actions workflow risks, and more), shipping 88 curated detections normalized into a CWE-keyed schema. Engine binaries are SHA-pinned and signature-verified; there is no telemetry. Compliance mappings are code-level coverage only, never certification.
Upstash's official server providing up-to-date third-party library docs for AI coding assistants
AI-powered NPM package analysis MCP server
An independent control layer that gives AI coding agents budgets, brakes, and receipts
GitHub's official MCP server for managing repos, issues, PRs, and workflows via natural language
Source revision 8dbdd6bc3bfa Data synced 2026-10-19 Read the FMRS scoring method